Igor’s Tip of the Week #149: Using symbolic constants in the decompiler

We’ve covered the usage of symbolic constants (enums) in the disassembly. but they are also useful in the pseudocode view.

Reusing constants from disassembly

If a number has been converted to a symbolic constant in the disassembly and it is present in unchanged form in pseudocode, the decompiler will use it in the output. For example, consider this call:

.text:00405D72   push    1               ; nShowCmd
.text:00405D74   cmovnb  eax, [esp+114h+lpParameters]
.text:00405D79   push    0               ; lpDirectory
.text:00405D7B   push    eax             ; lpParameters
.text:00405D7C …

decompiler disassembly malware analysis pseudocode week